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Independent Orbiter Assessment 

Assessment of the Rudder/Speed Brake Actuator Subsystem FMEA/CIL 


1.0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company (MDAC) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL) . Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206, Instructions 
for Preparation of FMEA and CIL . 

The IOA effort first completed an analysis of the Rudder/Speed 
Brake (RSB) hardware, generating draft failure modes and poten- 
tial critical items. To preserve independence, this analysis was 
accomplished without reliance upon the results contained within 
the NASA FMEA/CIL documentation. The IOA results were then 
compared to the NASA FMEA/CIL baseline along with the proposed 
Post 51-L CIL updates included. A resolution of each discrepancy 
from the comparison was provided through additional analysis as 
required. This report documents the results of that comparison 
for the Orbiter RSB hardware. 

The IOA product for the RSB analysis consisted of thirty-eight 
failure mode "worksheets" that resulted in twenty-seven potential 
critical items being identified. Comparison was made to the NASA 
baseline (as of 7 December 1987) which consisted of (Note 1) 
thirty-four FMEAs and eighteen CIL items. The comparison 
determined if there were any results which had been found by the 
IOA but were not in the NASA baseline. This comparison produced 
agreement on all CIL items. Based on the Pre 51-L baseline, all 
non-CIL FMEAs were also in agreement. Based on discussions with 
the NASA subsystem manager, no additional non-CIL FMEAs are 
anticipated for the past 51-L update. Figure 1 presents a 
comparison of the proposed Post 51-L NASA baseline, with the IOA 
recommended baseline, and any issues. 

Note 1. The comparison of NASA FMEA Non-CIL items is based on 
the Pre 51-L baseline since all Post 51-L FMEAs have not been 
received as the date of this report. 

The issues arose due to differences between the NASA and IOA 
FMEA/CIL preparation instructions. NASA had used an older ground 
rules document which has since been superseded by the NSTS 22206 
used by the IOA. After comparison, there were no discrepancies 
found that were not already identified by NASA, and the remaining 
issues may be attributed to differences in ground rules. 
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RSB ACTUATOR ASSESSMENT OVERVIEW 
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Figure 1 - RSB FMEA/CIL ASSESSMENT SUMMARY 
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2.0 


INTRODUCTION 


2 . l Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS) . The NSTS Office has 
undertaken the task of re-evaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing an independent assessment 
of the proposed Post 51-L Orbiter FMEA/CIL for completeness and 
technical accuracy. 

2 . 2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the proposed Post 51-L NASA and Prime 
Contractor FMEA/CIL. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEA/CIL which is 
documented in this report. 


Step 1.0 Subsystem Familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2.3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3.1 Construct matrix of failure modes 

3.2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4 . 2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 Ground Rules and Assumptions 

The ground rules and assumptions used in the IOA are defined in 
Appendix B. There were no subsystem specific ground rules and 
assumptions used in this analysis. 


3 . 0 SUBSYSTEM DESCRIPTION 


3.1 Design and Function 

The Rudder/Speedbrake Actuation Subsystem consists of that , 
hardware required to provide both directional and energy control 
of the Orbiter during entry. The RSB subsystem consists of the 
following components. 

1. A PDU is made up of two halves which are identical in 
makeup and operation: one for rudder and one for 
speedbrake. A switching valve determines which of the 
three Orbiter hydraulic systems supplies the PDU 
electro-hydraulic Servo VLV (E-H Servo VLV) . There are 
eight E-H Servo VLVs: four in each PDU half. Each half 
of the PDU is controlled by four E-H Servo VLVs which 
receive commands from four Aerosurface Amplifiers/Flight 
Control System (ASA/FCS) channels. 

Each E-H Servo VLV receives from its ASA a position 
error command which it changes to a hydraulic pressure 
command. This is ported to a triplex power valve where 
the pressure (secondary Delta P) along with pressures 
from the three other E-H Servo VLVs command two valves 
that control pressure to three hydraulic motor/brake 
assemblies. These motors are used to drive a 
differential gearbox which sums all three motor torques 
and outputs it to a single drive shaft. The shaft is 
connected to a mixer gearbox. The mixer gearbox takes 
the drive shaft inputs from both the rudder and 
speedbrake channels, mixes them, and outputs them to a 
set of four rotary actuators which move the vertical 
panels. When the output shafts rotate in the same 
direction, the two panels move in the same direction 
thus providing rudder control. When the output shafts 
rotate in the opposite direction, the two panels move in 
opposite direction thus acting as a speedbrake. 

For each E-H Servo VLV there is an isolation valve which 
will isolate a failed E-H Servo VLV when its secondary 
delta P fails the ASA fault detection limits. The 
isolation valve can be commanded from the ASA, a crew 
keyboard input or an FCS switch taken to off. The crew 
can also inhibit an ASA isolation valve command by 
placing a FCS switch in the ORIDE position. If a 
problem develops within an E-H Servo VLV or its 
commanded position is different than the others, 
secondary delta P should begin to rise. Each channel 
has a secondary delta P transducer (LVDT) which sends 
Delta P to the ASA. Once the ASA detects secondary 
delta P at or above 2200 PSI for more than 120 msec, it 
will send an isolation command to the appropriate 
isolation valve which bypasses hydraulic pressure to the 
E-H Servo VLV causing its commanded pressure to the 
power spool to drop to zero. 
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Position from the Rotary Variable Differential 
Transformer (RVDT) on the differential gearbox are sent 
to the ASA and to the crew displays. Position is not 
used by the ASA for failure detection; it is used only 
to modify (negative feedback) the position command 
generated by the General Purpose Computer (GPC) . The 
following is a list of the components of the PDU which 
were reviewed and analyzed for failure modes. 

a. Switching Valve 

b. Standby Hydraulic Circulation Valve 

c. E-H Servo VLV 

d. E-H Servo VLV Filter 

e. Bypass Valve 

f. Secondary Delta P Transducer 

g. Triplex Power Valve 

h. Hydraulic Motor/Brake Assembly 

i. Differential Gearbox 

j . Position Transducer 

k. Mixer Gearbox 

2. There are four geared rotary actuators which drive the 
two aerosurface panels. Commands from the PDU mixer 
gearbox are transmitted via two shaft outputs to the two 
columns of aluminum drive shafts connecting the four 
rotary actuators. Internal gears pick up the drive 
shaft inputs and move the brackets that contain the 
aerosurface fastening points. The Orbiter fastening 
points are fixed, attached to Orbiter structure. Each 
rotary actuator is made up of two driver gear 
assemblies, a series of satellite gear assemblies, and 
two center drum assemblies which drive independently of 
each other. Driveshaft rotations in the same direction 
will turn the center drums and therefore the aerosurface 
fastening in the same direction (rudder control) . 
Driveshaft rotations in the opposite directions drive 
the center drums in opposite directions (speedbrake 
control) . 

3 . 2 Interfaces and Locations 

The RSB interfaces with the four ASAs which receive commands via 
four FA MDM's from the four GPCs. Crew initiated inputs; Rudder 
Pedal Transducer Assembly (RPTA) , Speedbrake Translation 
Controller (SBTC) , and Rotation Hand Controller (RHC) , are 
inputted to the GPCs. The crew can turn power on or off to any 
ASA channel, can place a FCS channel switch in ORIDE which 
bypasses the ASA fault detection circuitry, and send bypass 
inhibit commands to the ASA via keyboard entry. 
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The RSB actuation mechanism is physically located in the vertical 
stabilizer. The ASAs which provide position commands to the 
actuators are located in avionics bays 4, 5, and 6. The Surface 
Position Indicator (SPI) provides a gauge type display for the 
crew to check aerosurface position. It is located between 
Cathode Ray Tubes (CRTs) 1 and 2 on panel F7. The following CRT 
displays are available to the crew: GNC System Summary 1 (PASS 
and BPS) , Spec 53 Entry Control Display, FCS Dedicated Display 
Checkout (during OPS 8) and the Caution and Warning (Panel F7) 
(FCS Saturation, FCS Channel and Backup C/W Alarm) . The two sets 
of switches which provide crew inputs to the actuator ASA system 
are the FCS channel monitor switches on Panel C-3 and the ASA 
power switches on Panels 014, 015, and 016. 

3.3 Hierarchy 

Figure 2 shows the RSB PDU block diagram. Figures 3 through 9 
show individual components which were analyzed for failure modes. 
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Figure 2 - RSB PDU BLOCK DIAGRAM 
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Figure 6 - SWITCHING VALVE 
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Figure 7 - MECHANICAL DRIVE 
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Figure 8 - RSB AND BF TORQUE TUBE CONFIGURATION 
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Figure 9 - ROTARY ACTUATOR CUT AWAY 
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4 . 0 ASSESSMENT RESULTS 

The IOA analysis of the RSB hardware initially generated thirty- 
eight failure mode worksheets and identified twenty-seven 
Potential Critical Items (PCIs) before starting the assessment 
process. These analysis results were compared to the proposed 
NASA Post 51-L baseline (20 May 1987) of (Note 1) thirty-four 
FMEAs and twenty CIL items, and the updated (7 December 1987) 
version of (Note 1) thirty-four FMEAs and eighteen CIL items. 

The discrepancy between the number of IOA and NASA FMEAs can be 
explained by the different approach used by NASA and IOA to group 
failure modes. Upon completion of the assessment and after 
discussions with the NASA subsystem manager, an agreement between 
the NASA FMEA/CIL items and the IOA failure modes was reached. 

Note 1. Have received Post 51-L items only. Have not received 
all the Post 51-L NASA FMEAs as of the date of this request. 
Non-CIL items comparison was based on review of NASA Pre 51-L 
baseline and IOA correlation and analysis. 


In the following, the unmapped IOA column is the raw number of 
IOA failure modes. The mapped IOA column is the number of IOA 
failure modes after they have been mapped into the NASA FMEAs. 

The issues column is the IOA failure modes that were unable to be 
mapped onto NASA FMEA. 


RSB 

Elements 

IOA 

Unmapped 

IOA 

Mapped 

NASA 

Issues 

PDU 

36 

32 

32 

0 

Rotary Actuator 

1 

1 

1 

0 

Drive Shaft 

1 

1 

1 

0 


38 

34 

34 

0 


Appendix C presents the detailed assessment worksheets for each 
failure modes identified assessed. Appendix D highlights to the 
NASA critical items and corresponding IOA worksheet ID. Appendix 
E contains IOA analysis worksheets supplementing previous 
analysis results reported in STS Engineering and Operations 
Support (STSEOS) Working Paper 1. 0-SP-VA86001-04 , Analysis of the 
RSB, 3 December 1986. No supplemental analysis worksheets were 
generated for the RSB assessment. Appendix F provides a cross- 
reference between the NASA FMEA and corresponding IOA worksheets. 
IOA recommendations are also summarized. 

A summary of the quantity of NASA FMEAs assessed, versus the 
recommended IOA baseline, and any issues identified is presented 
in Table I. 
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A summary of the quantity of NASA CIL items assessed, versus the 
recommended IOA baseline, and any issues identified is presented 
in Table II. 


Table II Summary of IOA CIL Assessment 


Component 


o PDU 

PDU Elements 
o Switch Valve 
o Recirculation Valve 
o EH Servovalve 
o By-Pass Valve 
o Filter 

o Secondary Delta P 
X-DCER 

o Power Valve 
o Motor/ Brake 
o Differential Gearbox 
o Position X-DCER 
o Mixer Gearbox 
o Rotary Actuator 
o Drive Shaft 


TOTAL 


NASA IOA 
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Table III presents a summary of the IOA recommended failure 
criticalities for the Post 51-L FMEA baseline. Further 
discussion of each of these subdivisions and the applicable 
failure modes is provided in subsequent paragraphs. 


TABLE III Summary 

of IOA Recommended 

Failure Criticalities 

Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

o PDU 

2 

— 

- 

1 

- 

4 

7 

PDU Elements 








o Switch Valve 


1 

- 

2 

- 

1 

4 

o Recirculation Valve 

- 

- 

- 

- 

- 

2 

2 

o EH Servovalve 

- 

1 

- 

1 

- 

- 

2 

o By-Pass Valve 

- 

- 

- 

1 

- 

- 

1 

o Filter 

1 

- 

- 

- 

- 

1 

2 

o Sec. Delta P X-DCER 

- 


- 

1 

- 

- 

1 

o Power Valve 

1 

- 

- 

- 

- 

- 

1 

o Motor/Brake 

2 

1 

- 

1 

- 

1 

5 

o Differential 

2 

1 

- 

1 

— 

— 

4 

Gearbox 








o Position X-DCER 

1 

- 

- 

1 

- 

- 

2 

o Mixer Gearbox 

1 

- 

- 

- 

- 

- 

1 

o Rotary Actuator 

1 

- 

- 

- 



1 

o Drive Shaft 

1 

— 

— 

— 


— 

1 

TOTAL 

12 

4 

- 

9 

- 

9 

34 
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Of the failure inodes analyzed, eighteen were determined to be 
critical items. A summary of the IOA recommended critical items 
is presented in Table IV. 


TABLE IV Summary of IOA Recommended Failure Criticalities 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

o PDU 

2 

- 

- 

- 



2 

PDU Elements 








o Switch Valve 

- 

1 

- 

- 

- 

- 

1 

o Recirculation Valve 


- 

- 

- 

- 

- 

- 

o EH Servovalve 

- 

1 

- 

1 

- 

- 

2 

o By-Pass Valve 

- 

- 

- 

- 

- 

- 

— 

o Filter 

1 

- 

- 


- 

- 

1 

o Sec. Delta P X-DCER 

- 

- 


- 

- 

— 

— 

o Power Valve 

1 

- 

- 

- 

- 

- 

1 

o Motor/Brake 

2 

1 

- 

1 

- 

— 

4 

o Differential 

2 

1 

— 

— 

— 

— 

3 

Gearbox 








o Position X-DCER 

1 

- 

- 

- 

- 


1 

o Mixer Gearbox 

1 

- 

- 

- 

- 


1 

o Rotary Actuator 

1 

- 

- 

- 

- 

- 

1 

o Drive Shaft 

1 

— 

— 

— 



1 

TOTAL 

12 

4 

1 

2 

1 

■ 

- 
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The scheme for assigning IOA assessment (Appendix C) and analysis 
(Appendix E) worksheet numbers is shown in Table V. 


Table V IOA Worksheet Numbers 

Component 

IOA ID Number 

o PDU 

RSB-101 thru RSB-103 ; RSB-106 thru RSB-109, 

o Hydraulic 

RSB-104, 105, RSB-110 thru RSB-123 

Valve Module 


o Hydraulic 

RSB-124 thru RSB-128 

Motor/Brake 


o Differential 

RSB-129 thru RSB-134; RSB-138 

Gearbox 


o Mixer Gearbox 

RSB-135 

o Rotary Actuator 

RSB-136 

o Drive Shaft 

RSB-137 
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4 . 1 PDU Assessment Results 

Failures which were related to the PDU as an entity were 
analyzed. Critical failures resulting in loss of vehicle/crew 
were associated with gross loss of hydraulic fluid due to 
complete seal failure, rupture of servoactuator in and downstream 
of the switching valve (manifold, return lines, LEE plugs) and 
hydraulic supply line rupture (one system) . These failures 
result in depletion of all three hydraulic supplies. 

Non-critical failures were associated with internal components 
which leaked hydraulic fluid. These leaks are contained within 
the PDU and do not cause depletion of the hydraulic system 
supplies. Other failures which were not critical were associated 
with the PDU heater blankets which are considered redundant. 

4 . 2 PDU Elements 

Components which make up the PDU were individually analyzed. In 
most cases, failures were included under one common assessment 
when the failures of a component had the same effect on the 
system operation. Those component failures which were analyzed 
separately and had the system effect were correlated with the 
NASA FMEA/CIL which combined like failures. Criticality 1 
failures were associated with contamination of hydraulic fluid 
which clogged filters and caused jamming of the hydraulic power 
valve spool. Both failures result in loss of the RSB function. 
Mechanical failures (sheared shaft/ spline or damaged barrel/valve 
plate) of the hydraulic motor/brake assembly resulted in 
criticality 1 failures resulting in loss of the RSB function. 
Mechanical failures also result in loss of the differential and 
mixer gearboxes causing loss of the RSB function. The failures 
were caused by fractures of gear shafts, splines or gears and 
seized bearings. The failure of the position transducer assembly 
(four transducers ganged together) also results in loss of the 
RSB function. A mechanical failure in the transducer drive train 
will result in loss of all four position transducers. 

In summary, criticality I failures were due to 1) hydraulic 
contamination and 2) mechanical failures in gear drive trains. 

4.3 Rotary Actuators 

Analysis of the rotary actuators which provide the torque 
required to move the RSB surfaces showed that either an open 
(gear shaft spline sheared, gear teeth broken) or a jam (seized 
gear or bearing, overload resulted in the loss of an actuator, 
loss of any one of the four actuators would result in overloading 
the remaining actuators causing them to fail with the resultant 
loss of the RSB function hence loss of vehicle control. 
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4.4 Drive Shafts 


The ten drive shafts transmit RPM/ torque between the PDU and the 
rotary actuators. Critical failures of the shafts were fractures 
and gears shearing from the shaft spline. Three failures result 
in loss of drive to or between the four rotary actuators with 
resultant loss of RSB control. 


1:3 


wi 

Eng 
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APPENDIX A 
ACRONYMS 


ASA 

BFS 

CfiW 

CIL 

CRT 

delta P 

E-H Servo VLV 

F 

FA 

FCS 

FMEA 

6NC 

GPC 

HW 

IOA 

LVDT 

MDAC 

MDM 

OMRSD 

OPS 

ORIDE 

PASS 

PDU 

RI 

RPTA 

RHC 

RSB 

RVDT 

SBTC 

SPI 

VLV 


Aerosurface Amplifier 
Backup Flight System 
Caution and Warning 
Critical Items List 
Cathode Ray Tube 
Differential Pressure 
Electro-Hydraulic Servovalve 
Functional 
Flight Aft 

Flight Control System 
Failure Modes Effects Analysis 
Guidance Navigation and Control 
General Purpose Computer 
Hardware 

Independent Orbiter Assessment 
Linear Variable Differential Transducer 
McDonnell Douglas Astronautics Company 
Multiplexer/Demultiplexer 
Operational Maintenance Requirements and 
Specifications Document 
Operational Sequence 
Override 

Primary Avionics Software System 
Power Drive Unit 
Rockwell International 
Rudder Pedal Transducer Assembly 
Rotation Hand Controller 
Rudder Speedbrake 

Rotating Variable Differential Transducer 
Speedbrake Translation Controller 
Surface Position Indicator 
Valve 


A-l 




APPENDIX B 


DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 


Definitions contained in NSTS 22206. Instructions For Preparation 
of FMEA/CIL. 10 October 1986 . were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS: 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

CREDIBLE j CAUSED - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
(PASS) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/objective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS: 

PRE LAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING /SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206, Instructions for 
Preparation of FMEA/CIL. 1U October was employed with the 

following amplifications and additions. . ,, 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to-be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures, caused by human operational error 
are out-of-scope of this task. 
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All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs, and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7. Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required. 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables, and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP) , pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 


B-5 



APPENDIX B 

DEFINITIONS , GROUND RULES, AND ASSUMPTIONS 

B.3 RSB Specific Ground Rules and Assumptions 

The IOA analysis was performed to the component or assembly 
level of the RSB subsystem. The analysis considered the 
worst case effects of the hardware or functional failure on 
the subsystem, and crew and vehicle safety. 
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APPENDIX C 
DETAILED ASSESSMENT 

This section contains the IOA assessment worksheets generated 
during the Assessment of the Rudder/Speed Brake Subsystem. The 
information on these worksheets facilitates the comparison of the 
NASA FMEA/CIL (Pre and Post 51-L) to the IOA detailed analysis 
worksheets included in Appendix E. Each of these worksheets 
identifies the NASA FMEA being assessed, corresponding MDAC 
Analysis Worksheet ID (Appendix E) , hardware item, criticality, 
redundancy screens, and recommendations. For each failure mode, 
the highest assessed hardware and functional criticality is 
compared and discrepancies noted as "N" in the compare row under 
the column where the discrepancy occurred. 


LEGEND FOR IOA ASSESSMENT WORKSHEETS 


Hardware Criticalities: 

1 * Loss of life or vehicle 

2 =* Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 = All others 

Functional Criticalities: 

1R *■ Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle 
2R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission 

Redundancy Screens A, B and C: 

P = Passed Screen 
F ■ Failed Screen 
NA = Not Applicable 

NASA Data : 

Baseline - NASA FMEA/CIL 

New ■ Baseline with Proposed Post 51-L Changes 

CIL Item : 

X * Included in CIL 
Compare Row : 

N - Non compare for that column (deviation) 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-101 

02 -4 C-0 11 10 0-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

101 

POWER DRIVE UNIT (PDU) 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 


C 

ITEM 

NASA 

[1/1 ] 

[ NA] 

[ NA] 

[ 

NA] 

[ X ] * 

IOA 

[1/1 ] 

[ NA] 

[ NA] 

[ 

NA] 

[ x ] 

COMPARE 

[ / ] 

[ 

] 

[ 

] 

[ 

] 

[ ] 

RECOMMENDATIONS : 

(If different 

from 

NASA) 




[ / ] 

[ 

] 

[ 

] 

[ 

] 

[ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 
[ ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-102 

02-4C-011100-3 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

102 

POWER DRIVE UNIT (PDU) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

C 


NASA 

[1/1 ] 

[ NA) 

[ NA] 

[ NA] 

[ x ] 

IOA 

[ 2 /1R ) 

[ NA] 

[ F ] 

[ p ] 

[ x ] 

COMPARE 

[ N /N ] 

[ ] 

[ N ] 

[ N ] 

[ ] 

RECOMMENDATIONS : 

(If different 

from 

NASA) 



[ / ] 

[ ] 

[ ] 

[ ] 

[ ] 


(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

NO ISSUE. LOSS OF HYDRAULIC PRESSURE TO ONE MOTOR/BRAKE ASSEMBLY 
RESULTS IN THE OTHER TWO MOTORS BACKDRIVING THE FAILED MOTOR 
RESULTING A COMPLETE TORQUE SPILLANT THUS LOSING THE RSB 
FUNCTION. 


REPORT DATE 02/03/88 


C-3 



APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-103 

02-4C-011100-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

103 

POWER DRIVE UNIT (PDU) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [ 3 /1R ] 

[ P ] 

[ P 1 

[ P ] 

[ 3 

IOA [ 2 /1R ] 

C F ] 

[ F ] 

[ P 3 

[ x ] 

COMPARE [ N / ] 

[ N ] 

[ N ] 

[ ] 

[ N ] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] C ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS l 

AGREE WITH NASA. INTERNAL LEAK IS CONTAINED WILL NOT DEPLETE 
HYDRAULIC SYSTEM SUPPLY. 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/87 NASA DATA: 

ASSESSMENT ID: RSB-104 BASELINE [ X ] 

NASA FMEA #: 02-40011102-1 NEW [ ] 

SUBSYSTEM: RSB 

MDAC ID: 104 

ITEM: FILTER 

LEAD ANALYST: R. WILSON 



ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 

FLIGHT ITEM 

HDW/FUNC A B C 

NASA [ 3 /1R ] [P] [F] [P] [X]* 

IOA [3/3 ] [ NA] [ NA] [ NA] [ ] 

COMPARE [ /N ] [ N ] [ N ] [ N ] [ N ] 


RECOMMENDATIONS: (If different from NASA) 

[ 3 /3 ] [ NA] [ NA] [ NA] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

FAILURE IS CONSIDERED TO BE A NON-CREDIBLE FAILURE. NO KNOWN 
CONDITIONS COULD EXIST WHICH WOULD RUPTURE THE FILTER - NASA PRE- 
BOARD REVIEW, CHANGE CRITICALITY TO 3/3. NO ISSUE. 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-105 

02-4C-011102-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: RSB 

MDAC ID: 105 

ITEM: FILTER 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

c 


NASA [1/1 3 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

IOA [1/1 ] 

[ HA] 

[ NA] 

[ NA] 

[ X ] 

COMPARE [ / ] 

[ 3 

[ 3 

[ 3 

[ 3 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ 3 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 

[ 3 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-106 

02 -4C-0 11118-01 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

106 

HEATER BLANKET 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

c 


NASA [3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 

IOA [3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 

COMPARE [ / ] 

[ ] 

[ ] 

[ ] 

[ 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] [ ] C ] C ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


ta 


El 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-107 

02 -4 C-0 11 118-02 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

107 

HEATER BLANKET 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 


FLIGHT 

HDW/FUNC 

A 

B 


c 

NASA 

[3/3 ] 

[ NA] 

[ NA] 

[ 

NA] 

IOA 

[3/3 ] 

[ NA] 

[ NA] 

[ 

NA] 


OIL 

ITEM 


[ ] * 

[ 3 


COMPARE [ / 


3 


RECOMMENDATIONS: (If different from NASA) 

[ / 3 [][][] C 3 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ 3 

INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 


12/07/87 

RSB-108 

02 -4 C-0 11118 -03 

RSB 

108 

HEATER BLANKET 
R. WILSON 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


ASSESSMENT: 




CRITICALITY 

REDUNDANCY SCREENS 

CIL 



FLIGHT 




ITEM 



HDW/FUNC 

A 

B 

C 



NASA 

[3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ ] * 

— 

IOA 

[3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 3 


COMPARE 

[ / ] 

[ ] 

[ 1 

[ ] 

[ 3 

— 

RECOMMENDATIONS : (If 

different 

from NASA) 




[ / ] 

[ ] 

[ ] 

[ ] 

[ 3 

__ 




(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-109 

02-4C-011118-04 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

109 

HEATER BLANKET 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 3 

IOA [3/3 ] 

[ NA) 

[ NA] 

[ NA] 

[ 3 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE ( ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-110 

02-4C-011101-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

110 

SWITCH VALVE 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 


** 

CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

C 



NASA [ 2 /1R ] 

[ P ] 

[ NA] 

[ P ] 

[ x 



IOA [ 2 /1R ] 

[ P ] 

[ P 1 

[ P ] 

[ x 

— 

COMPARE [ / ] 

[ ] 

[ N ] 

[ ] 

[ 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

NO ISSUE. CONCUR WITH NASA. 


E_. J? 

m 



REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-111 

02-4C-0111XX-X 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

111 

SWITCH VALVE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CIL 
ITEM 


[ 3 * 

[ X ] 

[ N ] 


C 3 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS • 

IF THE PRIMARY VALVE FAILS TO SWITCH TO STANDBY HYDRAULIC SYSTEM 
ON LOSS OF THE PRIMARY HYDRAULIC SYSTEM, VALVE 2 WILL SWITCH TO 
STANDBY 2 HYDRAULIC SYSTEM. A LOSS OF PRESSURE FROM STANDBY 2 
HYDRAULIC SYSTEM WILL RESULT IN LOSS OF HYDRAULIC PRESSURE 
TO THE SERVOVALVES WHICH RESULTS IN LOSS OF RSB CONTROL. THE 
INITIAL IOA ANALYSIS CONSIDERED THIS FAILURE TO HAVE A 2/1R 
CRITICALITY. HOWEVER, AS THE RESULT OF FURTHER ANALYSIS DURING 
THE ASSESSMENT PERIOD THE FAILURE CRITICALITY CAN BE DOWNGRADED 
TO 3/1R. THIS FAILURE CAN BE DETECTED AND REQUIRES THREE 
FAILURES BEFORE THERE IS ANY EFFECT ON THE ACTUATOR. 


CRITICALITY 

REDUNDANCY SCREENS 

FLIGHT 




HDW/FUNC 

A 

B 

c 

NASA [ 3 /1R ] 

[ P 3 

[ P 3 

[ P 3 

IOA [ 2 /1R ] 

[ P 3 

[ P 3 

[ P 3 

COMPARE [ N / ] 

C 3 

[ 3 

[ 3 


RECOMMENDATIONS: (If different from NASA) 

[ / 3 [][][] 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-112 

02-4C-011101-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 

ITEM: 

LEAD ANALYST: 


RSB 

112 

SWITCH VALVE 
R. WILSON 


ASSESSMENT : 





CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [ 3 /1R ] 

[ P ] 

[ P ] 

[ P ] 

[ ] * 

IOA [ 3 /1R ] 

C P ] 

[ P ] 

[ P ] 

[ ] 

COMPARE [ / ] 

[ ] 

[ ] 

t ] 

[ ] 


RECOMMENDATIONS : 


(If different from NASA) 


[ / 3 [ ] C ] [ 


[ 3 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA # : 


12/07/87 

RSB-113 

02-4C-011101-3 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

113 

SWITCH VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [ 3 /3 ] [ NA] [ NA] [ NA] 

IOA [ 3 /3 ] [ NA] [ NA] [ NA] 


[ 3 * 

[ 3 


COMPARE [ / 


3 


RECOMMENDATIONS: (If different from NASA) 

[ / 3 [][][] [3 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 


C-14 


APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/87 

ASSESSMENT ID: RSB-114 

NASA FMEA #: 02-4C-011104-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

114 

HYDRAULIC VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 3 /1R ] 

[ P ] 

[ F ] 

[ P ] 

[ X ] * 

IOA 

[ 2 /1R ] 

[ P ] 

[ F ] 

[ P ] 

[ x ] 

COMPARE 

[ N / ] 

C ] 

[ 1 

[ ] 

[ ] 

RECOMMENDATIONS : ( If 

different from NASA) 

. . _ ... 


[ / ] 

[ ] 

C ] 

C ] 

[ ] ' 





(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS l 

NASA INCLUDEDS THIS FAILURE AMONT OTHERS HAVING THE SAME EFFECT 
IN ONE FMEA. IOA CONSIDERED AS A SEPARATE MODE SINCE EACH 
FAILURE WAS CONSIDERED SEPARATELY. NO DISAGREEMENT OR ISSUE. 
MDAC-117, MDAC-115 , AND MDAC-118 ARE INCLUDED IN THE NASA/RI 
FMEA. AGREE WITH CRITICALITY, REMAINING THREE CHANNELS ARE 
UTILIZED FOR FLIGHT CONTROL. POSSIBLE LOSS OF CREW/VEHICLE AFTER 
THREE FAILURES. 


REPORT DATE 02/03/88 


C-15 



APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-115 

01-4C-0 11104-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

115 

HYDRAULIC VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 



C 

ITEM 

NASA 

[ 3 /1R ] 

[ P 3 

[ F 

3 

[ 

P 3 

[ x 

IOA 

[ 2 /1R ] 

[ P 3 

[ P 

3 

[ 

P 3 

[ x 

COMPARE 

[ N / ] 

[ 3 

[ N 

3 

[ 

3 

[ 

RECOMMENDATIONS : (If 

different 

from 

NASA) 




[ / 3 

[ 3 

[ 

3 

[ 

3 

' [ 


(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

FMEA 02 -4C-0 11104-1 (MDAC ID 114) CONSIDERED FAILING TO MOVE 
VALVE FROM NULL WHEN CO MMAN DED. AFTER THE VALVE HAS MOVED TO A 
COMMANDED POSITION, FAILURE TO RETURN TO NULL IS CONSIDERED TO BE 
A POSSIBLE FAILURE, HOWEVER BOTH FAILURES CAUSE THE SAME 
EFFECT. AGREE TO COMBINING UNDER ONE FMEA/CIL. 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-116 

02-4C-011104-3 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

116 

HYDRAULIC VALVE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [ 2 /1R ] 

[ P 3 

[ F ] 

[ p 3 

[ x 

IOA [ 2 /1R ] 

[ P 3 

[ F ] 

[ p 3 

[ x 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / 3 [][][] [ 3 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA. NO ISSUE. 


REPORT DATE 02/03/88 
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ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-117 

02-4C-011104-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

117 

TORQUE MOTOR ASSEMBLY 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

C 


NASA 

[ 3 /1R ] 

C P ] 

[ F ] 

[ P ] 

[ x 

IOA 

[ 2 /1R ] 

C P ] 

[ F ] 

C p ] 

C x 

[PARE 

[ N / ] 

C 1 

C ] 

C ] 

C 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

NASA INCLUDES THIS FAILURE AMONG OTHER HAVING THE SAME EFFECT 
UNDER 02-4C-011104-1. MDAC IOA CONSIDERED AS A SEPARATE FAILURE 
MODE SINCE EACH COMPONENT WAS ANALYZED SEPARATELY. NO 
DISAGREEMENT OR CONFLICT WITH NASA. INCLUDE AS A FAILURE UNDER 
MDAC- 114. NO ISSUE. 


\ 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-118 

02 -4C-0 11104-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

118 

TORQUE MOTOR ASSEMBLY 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 



FLIGHT 






HDW/FUNC 

A 

B 

C 


NASA 

[ 3 /1R ] 

[ P ] 

[ F ] 

[ P 

] 

IOA 

[ 2 /1R ] 

[ P ] 

[ F ] 

[ P 

] 

COMPARE 

[ N / ] 

[ ] 

[ ] 

[ 

] 


CIL 

ITEM 


[ X ] * 

[ X ] 

C ] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] c • ] [ ] C ] t ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

NASA INCLUDES THIS FAILURE AMONG OTHERS HAVING THE SAME EFFECT 
UNDER 02 -4C-0 11104-1. MDAC IOA CONSIDERED AS A SEPARATE FAILURE 
MODE SINCE EACH COMPONENT WAS ANALYZED SEPARATELY. NO 
DISAGREEMENT OR CONFLICT WITH NASA. INCLUDE AS A FAILURE UNDER 
MDAC- 114. NO ISSUE. 


REPORT DATE 02/03/88 


C-19 



APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-119 

02-4C-011104-4 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

119 

SECONDARY DELTA P TRANSDUCER (4R, 4SB) 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 3 /1R ] 

[ P ] 

[ P ] 

C P ] 

[ 3 

IOA 

C 2 /1R ] 

[ P ] 

[ F ] 

C P ] 

[ x ] 

COMPARE 

[ N / ] 

[ ] 

[ N ] 

C ] 

[ N ] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 


REMARKS: 

AGREE THAT FAILURE IS DETECTABLE. THREE REMAINING TRANSDUCERS 
PROVIDE ADEQUATE FEEDBACK TO ASA. TAKES THREE FAILURES TO CAUSE 
LOSS OF CONTROL FUNCTIONS. 


NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-120 

02-4C-011104-X 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

120 

ISOLATION VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 

FLIGHT ITEM 

HDW/FUNC ABC 


NASA [ 3 /1R ] [ P ] [ P ] [ P ] 

IOA [ 3 /1R ] [ P ] [ P ] [ P ] 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS : 


(If different from NASA) 


C 


/ 


[ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-121 

02-4C-011119-01 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

121 

RECIRCULATION VALVE (1R, 1SB) 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 


C 

ITEM 

NASA 

[3/3 ] 

[ NA] [ 

NA] 

[ 

NA] 

[ 3 * 

IOA 

[3/3 ] 

[ NA] [ 

NA] 

[ 

NA] 

[ 3 

COMPARE 

C / 1 

[ ] E 

] 

[ 

] 

[ 3 

RECOMMENDATIONS : 

(If different 

from 

NASA) 




[ / ] 

[ ] [ 

] 

[ 

3 

[ 3 






(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


C 

[ 


] 

] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-122 

02 -4 C-0 111 19 -02 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

122 

RECIRCULATION VALVE (1R, 1SB) 


LEAD ANALYST: R. WILSON 

ASSESSMENT : 



CRITICALITY 

REDUNDANCY SCREENS 


FLIGHT 

HDW/FUNC 

A 

B 


c 

NASA 

[3/3 ] 

[ NA] 

[ NA] 

[ 

NA] 

IOA 

[3/3 ] 

[ NA] 

[ NA] 

[ 

NA] 


CIL 

ITEM 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] t 3 t 3 [ 3 [ 3 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


3 

3 


REPORT DATE 02/03/88 


C-23 



APPENDIX C 

ASSESSMENT WORKSHEET 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 

SUBSYSTEM: RSB 

MDAC ID: 123 

ITEM: TRIPLEX POWER VALVE 


ASSESSMENT DATE: 12/07/87 
ASSESSMENT ID: RSB-123 

NASA FMEA #: 02-4C-011106-1 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x ] 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x ] 

COMPARE [ / ] 

[ ] 

[ ] 

[ ] 

[ ] 


RECOMMENDATIONS: (If different from NASA) 


[ / ] [][][] C ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/87 

ASSESSMENT ID: RSB-124 

NASA FMEA #: 02-4C-011108-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 

ITEM: 

LEAD ANALYST: 


RSB 

124 

HYDRAULIC MOTOR 
R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

c 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

COMPARE [ / ] 

[ ] 

[ ] 

[ ] 

[ ] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-125 

02 -4C-0 11108-1 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

125 

HYDRAULIC MOTOR 


LEAD ANALYST: R. WILSON 

ASSESSMENT : 

CRITICALITY 


REDUNDANCY SCREENS 


CIL 



FLIGHT 

HDW/FUNC 

A 

B 


c 

ITEM 

NASA 

[3/3 ] 

[ NA] 

C NA] 

[ 

NA] 

[ ] * 

IOA 

[3 /1R ] 

[ P ] 

[ F ] 

[ 

P ] 

[ x ] 

COMPARE 

[ /N ] 

[ N ] 

C N ] 

[ 

N ] 

[ N ] 

RECOMMENDATIONS : 

(If different 

from 

NASA) 




[ / ] 

C ] 

C ] 

C 

] 

[ 1 


(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

NASA CONSIDERS THIS FAILURE TO HAVE A 3/3 CRITICALITY SINCE 
THE MOTOR IS STILL FUNCTIONALLY OPERATIONAL EVEN AT REDUCED RATE 
THERE IS NO WAY THAT ANY LEAKAGE COULD OCCUR THAT WOULD DEGRADE 
THE MOTOR OUTPUT TO THE POINT THAT IT COULD BE BACK 
DRIVEN THROUGH THE DIFFERENTIAL GEARBOX BY THE OTHER TWO MOTORS. 

BASED ON DISCUSSIONS WITH THE SUBSYSTEM MANAGER, THERE IS 
AGREEMENT THAT THERE IS NO FUNCTIONAL CRITICALITY FOR THIS 
FAILURE MODE. CRITICALITY BECOMES 3/3. 

NO ISSUE. 


REPORT DATE 02/03/88 
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Hill 


APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-126 

02-4C-011110-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

126 

HYDRAULIC BRAKE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 


— 

CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 


ITEM 


HDW/FUNC 

ABC 



NASA [ 2 /1R ] 
IOA [ 2 /1R ] 


[ P ] [ NA] [ P ] 

[ P 1 [ F ] [ P ] 


[ X ] * 

C X ] 


COMPARE [ / 


[ N ] 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / 3 [ 3 [ 3 [ 3 [ 3 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-127 

02-4C-011110-3 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

127 

HYDRAULIC BRAKE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 3 /1R ] 

[ P ] 

[ F ] 

C P ] 

[ X ] * 

IOA 

[ 3 /1R ) 

[ P ] 

[ F ] 

[ p ] 

[ x ] 

COMPARE 

[ / ] 

[ 3 

[ 3 

[ ] 

[ 3 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] [ ] C ]. [ 3 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 

[ 3 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-128 

02-4C-0 11110-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

128 

HYDRAULIC BRAKE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

c 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE [ / ] 

[ ] 

[ ] 

[ ] 

[ 


RECOMMENDATIONS: (If different from NASA) 


[ / ] [ 

* CIL RETENTION RATIONALE: 
REMARKS: 


] [ ] C ] C ] 

(ADD/DELETE) 

(If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-129 

02-4C-011112-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

129 

SUMMER DIFFERENTIAL GEARBOX 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

c 

ITEM 

NASA 

[i/i 3 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[ i /i 3 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE 

[ / 3 

[ 3 

[ 3 

[ 3 

[ 


RECOMMENDATIONS : 


(If different from NASA) 


[ / ] [ ] E ] [ ] [ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS t 

THIS FMEA ALSO COVERS MDAC-130. NO DISAGREEMENT WITH COMBINING 
THESE FAILURE MODES. 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-130 

02 -4 C-0 11 112-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

130 

SUMMER DIFFERENTIAL GEARBOX 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 


C 

ITEM 

NASA 

[1/1 ] 

[ NA] 

[ NA] 

[ 

NA] 

[ X ] * 

IOA 

[1/1 ] 

[ NA] 

[ NA] 

[ 

NA] 

[ X ] 

COMPARE 

[ / ] 

[ ] 

[ ] 

[ 

] 

[ ] 

RECOMMENDATIONS : 

(If different 

from 

NASA) 




[ / ] 

[. ] 

[ ] 

[ 

] 

[ ] 

/ 7S. nn /nrT T ?rnr? \ 


(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 

THIS FAILURE IS COVERED UNDER ONE FMEA/CIL (MDAC-129) . NO 
DISAGREEMENT WITH COMBINING FAILURES UNDER ONE FMEA/CIL. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-131 

02-4C-011112-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

131 

SUMMER DIFFERENTIAL GEARBOX 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

c 

ITEM 

NASA 

t 2 /1R ] 

[ P ] 

[ F ) 

[ P 3 

[ X ] 

IOA 

[ 2 /1R ] 

[ P 3 

[ F ] 

[ P 3 

[ x ] 

COMPARE 

[ / 1 

[ 3 

[ 3 

[ 3 

[ 3 


RECOMMENDATIONS: (If different from NASA) 


[ / 


[ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-132 

02-4C-011112-3 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

132 

SUMMER DIFFERENTIAL GEARBOX 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 3 /1R ] 

[ P ] 

[ P ] 

t P ] 

[ 

IOA 

[ 3 /1R ] 

t P ] 

[ F ] 

[ P ] 

[ x 

COMPARE 

[ / 3 

[ ] 

[ N ] 

C ] 

C N 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] C ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA CRIT, AND ALSO THAT FAILURE PASSES SCREEN B. 
ISSUE . 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-133 

02-4C-011114-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

133 

POSITION TRANSDUCER 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


NASA [ 1 /I ] [ NA] [ NA] [ NA] 

IOA [1/1 ] [ NA] [ NA] [ NA] 


COMPARE [ / ] [][][] 


CIL 

ITEM 


[ X ] * 

[ X ] 

[ ] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-134 

02-4C-011114-3 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

134 

POSITION TRANSDUCER 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [ 3 /1R ] 

[ P ] 

[ P 3 

[ P 3 

[ 

IOA [ 2 /1R ] 

[ P ] 

[ F ] 

[ P 3 

[ x 

COMPARE [ N / ] 

[ 3 

[ N ] 

[ 3 

[ N 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

THERE IS AGREEMENT THAT THE CRITICALITY IS 3/1R AND PASSES B 
REDUNDANCY SCREEN. THE INITIAL IOA WAS BASED ON ASSUMING THAT 
THE ASA ELECTRONICS WOULD NOT DETECT THE FAILURE WHEN COMMANDING 
AT OR NEAR THE NULL POSITION. POSITION DATA IS NOT USED IN THE 
ASA AND IS READILY DETECTABLE IN FLIGHT. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-135 

02 -4 C-0 11 116-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

135 

MIXER GEARBOX (1) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [1/1 ] 

IOA [1/1 ] 


[ NA] [ NA] [ NA] 

[ NA] [ NA] [ NA] 


[ X ] * 

[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] [ ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/87 

ASSESSMENT ID: RSB-136 

NASA FMEA #: 02-4C-011300-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

136 

GEAR ROTARY ACTUATOR (4) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ X ] 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [][][] Cl 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/87 
ASSESSMENT ID: RSB-137 

NASA FMEA #: 02-4C-011200-1 


NASA DATA: 


BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 

ITEM: 

LEAD ANALYST: 
ASSESSMENT: 


RSB 

137 

DRIVE SHAFTS 
R. WILSON 


CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE 

[ / ] 

[ ] 

[ ] 

[ ] 

[ 

RECOMMENDATIONS : 

(If different 

from NASA) 



[ / ] 

[ ] 

[ ] 

[ ] 

[ 


(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 
[ ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/87 

RSB-138 

02-4C-011112-5 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


RSB 

138 

DIFFERENTIAL GEAR BOX 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

IOA 

[ 1 /l ] 
[1/1 ] 

[ NA] [ 

[ NA] [ 

NA] 

NA] 

[ NA] 
[ NA] 

[ X ] * 
[ X ] 

COMPARE 

[ / ] 

[ ] C 

] 

[ ] 

[ ] 

RECOMMENDATIONS : 

(If different 

from 

NASA) 



[ / ] 

[ ] [ 

] 

[ ] 

[ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

AT THE NASA PRE-BOARD REVIEW, THIS WAS TO BE ADDED TO A FMEA/ CIL. 
ACCEPTED BY PRE-BOARD. NO DISAGREEMENT OR CONFLICT. 


REPORT DATE 02/03/88 
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APPENDIX D 

POTENTIAL CRITICAL ITEMS 


NASA FMEA MDAC-ID 


02-4C-011100— 1 

101 

02-4C-011100-3 

102 


02-4C-011102-2 

105 

02-4C-011101-1 

110 

02-4C-011104-1 

114 

01-4C-0 11 104-1 

115 

02 -4 C-0 11 104 -3 

116 

02 -4 C-0 11104-1 

117 

02 -4C-0 11104-1 

118 

02 -4C-0 11106-1 

123 

02 -4 C-0 11108 -2 

124 

02-4C-011110-2 

126 

02-4C-011110-3 

127 

02 -4 C-0 11 110-1 

128 

02-4C-011112-1 

129 

02-4C-0 11112-1 

130 

02-4C-011112-2 

131 

02-4C-011114-2 

133 


02-4C-0 11116-1 

135 

02-4C-0 113 00-1 

136 

02-4C-011200-1 

137 

02-4C-011112-5 

138 


ITEM 

PDU 

PDU 

FILTER 
SWITCH VALVE 

EH SERVOVALVE 

EH SERVOVALVE 

EH SERVOVALVE 
EH SERVOVALVE 

EH SERVOVALVE 

POWER VALVE 

HYDRAULIC MOTOR 

HYDRAULIC BRAKE 
HYDRAULIC BRAKE 
HYDRAULIC BRAKE 
SUMMER DIFFERENTIAL 

SUMMER DIFFERENTIAL 

SUMMER DIFFERENTIAL 

POSITION TRANSDUCER 

MIXER GEARBOX 

ROTARY ACTUATOR 

DRIVE SHAFTS 
SUMMER DIFFERENTIAL 


FAILURE MODE 


EXTERNAL LEAKAGE, 
COMPONENT RUPTURE; 
GROSS FLUID 
LOSS 3 SYSTEMS 
EXTERNAL LEAKAGE, 

LINE RUPTURE; 

GROSS FLUID 
LOSS 1 SYSTEM 
CLOGGED 

SECONDARY VALVE 
FAILS TO SWITCH 
FAILS AT NULL 
UNDETECTED BY ASA 
FAILS TO RETURN TO 
NULL - UNDETECTED 
BY ASA 

NO ERRONEOUS OUTPUT 
TORQUE MOTOR FAIL 
UNDETECTED BY ASA 
FLAPPER VALVE FAIL 
UNDETECTED BY ASA 
FAILS, DRIVE OPEN/ 
DRIVE CLOSED 
NO RPM/TORQUE OUTPUT, 
OPEN DRIVELINE 
FAILS TO BRAKE 
FAILS TO RELEASE 
OPEN DRIVELINE 
OPEN OR PARTIAL 
JAMMED DRIVELINE 
OUTPUT JAMMED - 
2ND STAGE 
PARTIAL JAM - 
SINGLE DIFFERENTIAL 
GEAR MESH JAM 
FAIL ALL FOUR; 

LOSS OF MECHANICAL 
INPUT, ELECTRICAL 
OUTPUT 

OPEN, JAMMED ONE OR 
BOTH SHAFTS 
JAMMED, OPEN 
DRIVELINE 

OPEN OR JAMMED SHAFT 
1ST DIFFERENTIAL 
SHAFT OPEN - 
1ST STAGE 
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APPENDIX E 
DETAILED ANALYSIS 

This appendix contains the IOA analysis worksheets supplementing 
previous results reported in STSEOS Working Paper 1 . 0-WP-VA86001- 
04, Analysis of the RSB, (3 December 1986). Prior results 
were obtained independently and documented before starting the 
FMEA/CIL assessment activity. Supplemental analysis was 
performed to address failure modes not previously considered by 
the IOA. Each sheet identifies the hardware item being analyzed, 
parent assembly and function performed. For each failure mode 
possible causes are identified, and hardware and functional 
criticality for each mission phase are determined as described in 
NSTS 22206. Instructions for Preparation of FMEA and OIL . 

October 1986 . Failure mode effects are described at the bottom 
of each sheet and worst case criticality is identified at the 
top. There were no supplemental analysis worsheets, generated 
for the RSB. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 = Loss of life or vehicle 

2 = Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 = All others 

Functional Criticalities: 

1R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 


Redundancy Screen A: 

1 = Is Checked Out PreFlight 

2 = Is Capable of Check Out PreFlight 

3 = Not Capable of Check Out PreFlight 

NA = Not Applicable 


Redundancy Screens B and C: 
P = Passed Screen 
F = Failed Screen 
NA = Not Applicable 
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APPENDIX F 


NASA FMEA TO IOA WORKSHEET CROSS REFERENCE 


This section provides a cross reference between the NASA FMEA and 
corresponding analysis worksheet (s) included in Appendix E. The 
Appendix F identifies: NASA FMEA number, IOA assessment Number, 

NASA criticality and redundancy screen data, and IOA 
recommendations . 

Appendix F Resolution/Issue/Rational Codes 


Code Definition 

1. IOA concurs - NASA CCB considers this a non-credible 
failure - delete. 

All other initial IOA criticality and redundancy screen 
differences were resolved with the NASA subsystem 
manager. In addition, the combining of like failures 
under one FMEA were agreed to. 
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NASA FMEA TO IOA WORKSHEET CROSS REFERENCE / RECOMMENDATIONS 
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